81/15/2004" 11:01 4q?3437587 



Amendments to the Claims 



Claim t (currently amended): In a comp uti ng cnviiuiu i MU hum * c u uuu,U u u t u a ne t wile, n A 
computer program product embodied on a uimputu lu d abL m e d i um one or more computer : 
jeadablemedk re sult Uj a uaiipulu iu ml L uvk o ument , for establishing a securerkrw- 
aretted connection between a client application and a server application using existing pre: 
existing message types, said computer program product comprising: 

computer-readable program code means for piggy-backing, a request for a message 
encoding scheme proposal onto a first message sent from said client application to said server 
appUcation, wherein said first message uses a first existing pre-existing message type; 

computer-readable program code means for piggy-backing a first portion of security 
^ 1 o information onto a second message sent from said server application to said client appUcation, 
U wheremsaidsecomimess^^ 

12 first portion comprises a response to said request for a message encoding scheme; 

1 3 computer-readable program code means for piggy-backing a second portion of security 

14 irfbrmafionomoatedmes^ 

15 wherein said third message uses said first eM^r^e^dsfirig message type; and 

16 computer-readable program code means &r piggy-backing a third portion of security 

1 7 information onto a fourth message sent from said server application to said client application, 

18 wherein said fourth message uses a third easting pre-existing message type. 

1 Claim 2 (currently amended): The computer program product according to Claim 1, wherein said 

2 first costing pre-existing message type is a Hypertext Transfer Protocol (HTTP) GET request 



1 

2 

3 

4 

5 

6 

7 
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3 message, said ^ondcxBtmgffiS^ng message type is anHTTP REDIRECT message, and 

4 said third existing pre-existing message type is a response to said HTTP GET request message. 

1 Claim 3 (currently amended): The computer program product according to Claim I, wherein said 

2 first existing ^existing message type is a HyperText Transfer Protocol (HTTP) POST regues 

3 message, said second existing pre-existing, message type is an HTTP REDIRECT message, and 

4 ^dthirdex^Ere*^ 

1 Claim 4 (currently amended): The computer program product according to Claim 1, wherein said 

2 firstexistingpiSdad^ 

3 message, said second existing pre-existing message type is a WSP REDIRECT message, and said 

4 third existing nre-existing message type is a response to said WSP GET reguest message. 

1 Claim 5 (currently amended): The computer program product according to Claim 1 , wherein said 

2 first existing ESSSittag message type is a Wireless Session Protocol (W) POST reguest 

3 message, said second existing nre-existmg message type is a WSP REDIRECT message, and said 

4 third existing pre-existing message type is a response to said WSP POST reguM message. 

1 Claim 6 (original): The computer program product according to Claim 1 , wherein: 

2 said first message requests a secure page from said server application, wherein said secure 

3 page request farther comprises an identifier of said secure page; 

4 said second message sends a redirection message from said server application to said client 
Serial No. 09/415,645 -6- Docket RSW9-99-084 
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5 application, wherein said redirection message comprises a redirected identifier of said secure page; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said redirection message, wherein said subsequent request further 

8 comprises said redirected identifier of said secure page; and 

9 said fourth message sends a response to said subsequent secure page request to said client 

I o application, wherein said response further comprises a content portion encrypted using a session 

II key generated by said server application. 

1 Claim 7 (original): The computer program product accord to Claim 6, wherein: 

2 s «dfrstportionfinttercornr^ 
said second portion further comprises a set of information encrypted using a public key of 

4 said server application; and 

5 said third portion further comprises a nonce of said server application, encrypted using a 

6 public key of said client application. 



Claim 8 (original)-. The computer program product according to Claim 6, wherein: 
said first portion further comprises an identification of said server application; 
said second portion further comprises a set of information encrypted using a public key of 

4 said server application; and 

5 said third portion further comprises a nonce of said server application, encrypted using a 

6 public key of said client application. 
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1 Clam 9 (original); The computer program product according to Claim 7 or Claim 8, whereinsaid 

2 request for a message encoding scheme further comprises a keyword indicating said request. 



Claim 1 0 (original): The computer program product according to Claim 9, wherein said set of 
information comprises: zero or more parameters required for said secure page request; an 
identification of said client application; a client nonce; and optionally including a timestamp. 



1 
2 

3 page 



Claim 1 1 (currently amended): The computer program product according to Claim 6, wherein 
said redirected identifier of said secure page may^ k identical to said identifier of said secure 



1 Claim 1 2 (original): The computer program product according to Claim 1, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; 

4 said second message sends an authentication message from said server application to said 

5 client application; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said authenticatjon message; and 

8 said fourth message sends a response to said subsequent secure page request to said client 

9 application, wherein said response further comprises a content portion encrypted using a session 
10 key generated by said server application. 
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Claim 13 (original): The computer program product according to Claim 12, wherein said 
authentication message comprises a redirected identifier of said secure page, and wherein said 
subsequent request further comprises said redirected identifier of said secure page. 



Claim 1 4 (currently amended): A system for establishing a secureHo^^erhead connection 
between a client application and a server application using existing nre^tfcg message types to* 

uMiipuiiufe ui.iiumiu.iM. lumifc a tuuuutiuu nr V, said system comprising: 

means for piggy-backing a request for a message encoding scheme proposal onto a first 
aaessage sent from said client application to said server application, wherein said first message 

6 van a firf ** i *"»g pre-existing message type; 

7 means for piggy-backing a first portion of security information onto a second message sent 

8 fromsaidsemrappfic^^^ 

9 c^Ere^^mess^^ 

1 o request for a message encoding scheme; 

! i means for piggy-backing a second portion of security information onto a third message 

12 sent from said client application to said server application, wherein said third message uses said 

13 first exist i ng r rre-existing message type; and 

14 means for piggy-backing a third portion of security information onto a fourth message sent 

15 from said server application to said client application, wherein said fourth message uses a third 

16 existing pre-existing message type. 

1 Claim 15 (currently amended): The system according to Claim 14, wherein said first existing BIS; 

e mv jwmkcm -9- Docket RSW9-99-084 
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2 existing message type is a Hypertext Transfer Protocol (HTTP) GET request message, said 

3 second existing pre-existing message type is an HTTP www-Authenticate message header, and 

4 saidtnirdeti^pre^dstir^ 

1 Claim 16 (currently amended): The system according to Claim 1 4, wherein said first existing prer 

2 existing message type is a Hypertext Transfer Protocol (HTTP) POST reguest message, said 

3 second existing pre-existing message type is an HTTP www- Authenticate message header, and 

4 said third existing pre-existing message type is a response to said HTTP POST r^uejt message. 

1 Claim 17 (currently amended): The system according to Claim 14, wherein said first extsting mSi 

2 existing message type is a Wireless Session Protocol (WSP) GET reguest message, said second 

3 existing ore-existing message type is a WSP www-Authenticate message header., and said third 

4 existmgiHiHJxjs^ 

1 Claim 18 (currently amended): The system according to Claim 14, wherein said first existing mSi 

2 existing message type is a Wireless Session Protocol (WSP) POST request message, said second 

3 existing pre-existing message type is a WSP www-Authenticate message header, and said third 

4 existing ore-existing message type is a response to said WSP POST reguest message. 

1 Claim 19 (original): The system according to Claim 14, wherein; 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; 

SerialNo. 09/415,645 -10- Docket RSW9-99-084 
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4 said second message sends an authentication message from said server application to said 

5 client application; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said authentication message; and 

8 said fourth message sends a response to said subsequent secure page request to said client 

9 application, wherein said response further comprises a content portion encrypted using a session 
10 key generated by said server application. 



Claim 20 (original): The system according to Claim 1.9, wherein said authentication message 

2 comprises a redirected identifier of said secure page, and wherein said subsequent request further 

3 comprises said redirected identifier of said secure page. 

1 Claim 21 (original); The system according to Claim 19 or Claim 20 ? wherein: 

2 said first portion further comprises a security certificate of said server application; 

3 said second portion farther comprises a set of information encrypted using a public key of 

4 said server application; and 

5 said third portion further comprises a nonce of said server application, encrypted using a 

6 public key of said client application. 

1 Claim 22 (original): The system according to Claim 1 9 or Claim 20, wherein: 

2 said first portion further comprises an identification of said server application; 

3 said second portion further comprises a set of information encrypted using a public key of 

SerialNo. 09/415,645 -11- Docket RSW9-99-084 
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4 said server application; and 

5 said third portion further comprises a nonce of said server application, encrypted using a 

6 public key of said client application. 

1 Claim 23 (original): The system according to Claim 20, wherein $aid request for a message 

2 encoding scheme further comprises a keyword indicating said request. 

1 Claim 24 (original): The system according to Claim 23, wherein said set of information 

2 comprises: zero or more parameters required for said secure page request; an identification of 

3 said client application; a client nonce; and optionally including a timestamp. 

1 Claim 25 (original): The system according to Claim 22, wherein said request for a message 

2 encoding scheme further comprises a keyword indicating said request and wherein said set of 

3 information comprises: zero or more parameters required for said secure page request; an 

4 identification of said client application; a client nonce; and optionally including a timestamp. 

1 Claim 26 (currently amended): The system according to Claim 20, wherein said redirected 

2 identifier of said secure page may he is identical to said identifier of said secure page. 

1 Claim 27 (original): The system according to Claim 14, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; 

Serial No. 09/41 5,645 -1 2- Docket RSW9-99-084 
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4 said second message sends a redirection message from said server application to said client 

5 application, wherein said redirection message comprises a redirected identifier of said secure page; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said redirection message, wherein said subsequent request further 

8 comprises said redirected identifier of said secure page; and 

9 said fourth message sends a response to said subsequent secure page request to said client 

1 0 application, wherein said response farther comprises a content portion encrypted using a session 

1 1 key generated by said server application. 

1 ✓ CJaim 28 (currently amended): A method for establishing a secure, luw*owriiead connection 

2 between a client application and a server application using e xi sti ng pre-existing message types irra 

3 unnputing uiviiuumjcnl lu.vmg a cumicition to a network, said method comprising the steps of: 

4 piggy-backing a request for a message encoding scheme proposal onto a first message sent 

5 from said client application to said server application, wherein said first message uses a first 

6 enisling pre-existing message type; 

7 piggy-backing a first portion of security information onto a second message sent from said 

8 server application to said client application, wherein said second message uses a second existing 

9 pre-existing message type and wherein said first portion comprises a response to said request for a 

1 0 message encoding scheme; 

11 piggy-backing a second portion of security information onto a third message sent ftom 

12 said client application to said server application, wherein said third message uses said first existing 

13 pre-existing message type; and 

Serial No. 09/415,645 -13- Docket RSW9-99-084 
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14 piggy-backing a third portion of security information onto a fourth message sent from said 

15 server application to said client application, wherein said fourth message uses a third existing mSz 

1 6 existing message type. 

1 Claim 29 (currently amended): The method according to Claim 28, wherein said first existing 

2 pre-existing message type is a HyperText Transfer Protocol (HTTP) GET E^ugst message, said 

3 second e xisting pre-existing message type is an HTTP www- Authenticate message header, and 
' 4 said third existing pre-existing message type is a response to said HTTP GET reguest message. 

1 Claim 30 (currently amended): The method according to Claim 28, wherein said first existing 

2 preexisting message type is a HyperText Transfer Protocol (HTTP) POST reguest message, said 

3 second existing pre-existing message type is an HTTP www-Authenticate message header, and 

4 said third existing pre-existing message type is a response to said HTTP POST request message. 

1 Claim 3 1 (currently amended): The method according to Claim 28, wherein said first existing 

2 pre-existing message type is a Wireless Session Protocol (WSP) GET request message, said 

3 second existing ore-existing message type is a WSP www-Authenticate message header, and said 

4 third iMAting pre-existing message type is a response to said WSP GET request message, 

1 Claim 32 (currently amended): The method according to Claim 28, wherein said first existing 

2 pre-existing message type is a Wireless Session Protocol (WSP) POST request message, said 

3 second e xisting pre-existing message type is a WSP www-Authenticate message header, and said 

Serial No. 09/415,645 -14- Docket RSW9-99-084 



PAGE 16/45 * RCVD AT 1/15/2004 10:56:16 AM [Eastern Standard Timel * SVR:USPTO-EFXRF-1/0 * DNIS:8729306 * CSID:4073437587 * DURATION (mm.ss):1240 



01/15/2004' 11:01 4073437587 



FAX P^E 17 



4 third e x isting pre-existing message type is a response to said WSP POST request message. 

1 Claim 33 (original); The method according to Claim 28, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; 

4 said second message sends an authentication message from said server application to said 

5 client application; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said authentication message; and 

8 said fourth message sends a response to said subsequent secure page request to said client 

9 application, wherein said response farther comprises a content portion encrypted using a session 
10 key generated by said server application. 

1 Claim 34 (original) : The method according to Claim 33 , wherein said authentication message 

2 comprises a redirected identifier of said secure page, and wherein said subsequent request further 

3 comprises said redirected identifier of said secure page, 



1 Claim 35 (original): The method according to Claim 33 or Claim 34, wherein: 

2 said first portion further comprises a security certificate of said server application; 

3 said second portion further comprises a set of information encrypted using a public key of 

4 said server application; and 

5 said third portion further comprises a nonce of said server application, encrypted using a 
Serial No. 09/415,645 -15- Docket RSW9-99-084 



PAGE 17/45 * RCVD AT 1/15/20M 10:56:16 AM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/0 * DNlS:8729306 * CSID:4073437587 * DURATION (mm-ss):12-40 





01/15/2004 11:81 



4073437587 



FAX 



PAGE 18 



6 

I 
2 
3 
4 
5 
6 




2 



2 
3 

1 
2 
3 
4 

1 



public key of said client application. 

Claim 36 (original): The method according to Claim 33 or Claim 34, wherein: 

said first portion farther comprises an identification of said server application; 

said second portion further comprises a set of information encrypted using a public key of 

said server application; and 

said third portion further comprises a nonce of said server application, encrypted using a 

public key of said client application. 

Claim 37 (original): The method according to Claim 34, wherein said request for a message 
encoding scheme further comprises a keyword indicating said request. 

Claim 38 (original): The method according to Claim 37* wherein said set of information 
comprises: zero or more parameters required for said secure page request; an identification of 
said client application; a client nonce; and optionally including a timestamp. 

Claim 39 (original): The method according to Claim 36, wherein said request for a message 
encoding scheme further comprises a keyword indicating said request and wherein said set of 
information comprises: zero or more parameters required for said secure page request; an 
identification of said client application; a client nonce; and optionally including a timestamp. 

Claim 40 (currently amended): The method according to Claim 34, wherein said redirected 
Serial No. 09/415,645 -1.6- Docket RSW9-99-084 



1 RCVD AT 111512004 10:56:16 AM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/0 * DN1S:8729306 * CSID:4073437587 * DURATION (mm-ss):12-40 



01/15/2004* 11:01 4073437587 



FAX 



PAGE 19 



2 identifier of said secure page maybe ig identical to said identifier of said secure page. 

1 Claim 41 (original): The method according to Claim 28, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; 

4 said second message sends a redirection message from said server application to said client 

5 application, wherein said redirection message comprises a redirected identifier of said secure page; 

6 said third message sends a subsequent request for said secure page from said server 

7 application in response to said redirection message, wherein said subsequent request further 

8 comprises said redirected identifier of said secure page; and 

9 said fourth message sends a response to said subsequent secure page request to said client 

1 0 application* wherein said response further comprises a content portion encrypted using a session 

11 key generated by said server application. 



1 Claim 42 (currently amended): A method for establishing a secure , Iow*ovcrhcad connection 

2 between a client application and a server application using existing pre-existing message types ira 

3 lumpntiiig envir o nment luiing a eonnaclioii to a netwoik , said method comprising the steps of: 

4 piggy-backing a request for said server application to select a message encoding scheme 

5 onto a first message sent from said client application to said server application, wherein said first 

6 message uses a first east i ng pre-existing message type; and 

7 piggy-backing a first portion of security information onto a second message sent from said 

8 server application to said client application* wherein said second message uses a second cxistlutg 

Serial No. 09/415,645 -17- Docket RSW9-99-084 
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9 pre-existing message type and respond s to said first message. 

1 Claim 43 (currently amended): The method according to Claim 42, wherein said first existing 

2 pre-existing message type is a HyperText Transfer Protocol (HTTP) GET request message and 

3 said second existi n g pre-existing message type is a response to said HTTP GET request message. 

1 Claim 44 (currently amended): The method according to Claim 42, wherein said first existing 

2 pre-existing message type b a Hypertext Transfer Protocol (HTTP) POST request message and 
(l' 3 said second existing pre-existing message type is a response to said HTTP POST rcguest 

x 

\ 4 message. 

1 Claim 45 (currently amended): The method according to Claim 42, wherein said first existing 

2 pre-existing message type is a Wireless Session Protocol (WSP) GET request message and said 

3 second existing pre-existing message type i$ a response to said WSP GET request message. 

1 Claim 46 (currently amended); The method according to Claim 42, wherein said first lAisting 

2 pre-existing message type is a Wireless Session Protocol (WSP) POST request message and said 

3 second e&isting pre-existing message type is a response to said WSP POST request message. 

1 Claim 47 (original): The method according to Claim 42, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; and 

Serial No. 09/415,645 -18- Docket RSW9-99-084 
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4 said second message sends a response to said secure page request to said client 

5 application, wherein said response farther comprises a content portion encrypted using a session 

6 key generated by said server application* 

1 Clam 48 (original): The method according to Claim 47, wherein: 

2 said request to select a message encoding scheme farther comprises an identifier of said 

3 client application, a nonce of said client application, mi optionally including a timestamp; and 

4 said first portion further comprises a set of information encrypted using a public key of 

5 said server application* 

1 Claim 49 (original): The method according to Claim 48, wherein said set of information further 

2 comprises: 

3 a nonce of said server application, encrypted using a public key of said client application; 

4 and 

5 a security certificate of said server application. 

1 Claim 50 (original): The method according to Claim 48 or Claim 49, wherein first message 

2 further comprises zero or more parameters required for said secure page request. 

1 Claim 5 i (currently amended); A system for establishing a secure, fow o vcrhead connection 

2 between a client application and a server application using existing pre-existing message types ira 

3 computing eirviiunme n i having a connection to a net work, said system comprising: 

Serial No. 09/415,645 -19- Docket RSW9-99-084 
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4 means for piggy-backing a request for said server application to select a message encoding 

5 scheme onto a first message sent from said client application to said server application, wherein 

6 said first message uses a first e justiJiiij: pre-existing message type; and 

7 means for piggy-backing a first portion of security information onto a second message sent 

8 from said server application to said client application, wherein said second message uses a second 

9 ex i sting pre-existing message type and responds to said first message . 

1 Claim 52 (currently amended): The system according to Claim 5 1 , wherein said first ex isting g££z 
^ 2 existing message type is a HyperTcxt Transfer Protocol (HTTP) GET request message and said 
3 second e xi sti n g pre-existing message type is a response to said HTTP GET request message. 

1 Claim 53 (currently amended); The system according to Claim 5 1 , wherein said first existing pre- 

2 existing message type is a Wireless Session Protocol (WSP) GET request message and said 

3 second tAi&ting pre-existing message type is a response to said WSP GET request message. 

1 Claim 54 (original): The system according to Claim 5 1 , wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; and 

4 said second message sends a response to said secure page request to said client 

5 application, wherein said response further comprises a content portion encrypted using a session 

6 key generated by said server application. 
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1 Claim 55 (original): The system according to Claim 54, wherein: 

2 said request to select a message encoding scheme further comprises an identifier of said 

3 client application* a nonce of said client application, and optionally including a timestamp; and 

4 said first portion further comprises a set of information encrypted using a public key of 

5 said server application* 

1 Claim 56 (original): The system according to Claim 55, wherein said set of information further 

2 comprises: 

^3 a nonce of said server application, encrypted using a public key of said client application; 

4 and 

5 a security certificate of said server application. 

1 Claim 57 (original): The system according to Claim 55 or Claim 56, wherein first message further 

2 comprises zero or more parameters required for said secure page request 

1 Claim 58 (currently amended): In a computing env ir onment having a connection to a ne t w o rk, a 

2 A computer program product embodied on & computer readable medium r eadable by a com p u t er 

3 in said environment one or more computer-readable media for establishing a secure , tow* 

4 ove r head connection between a client application and a server application using existing pre- 

5 existing message types, said computer program product comprising: 

6 computer-readable program code means for piggy-backing a request for said server 

7 application to select a message encoding scheme onto a first message sent from said client 

Serial No. 09/415,645 -21- Docket RSW9-99-084 
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8 application to said server application, wherein said first message uses a first existing pr^qxistiqft 

9 message type; and 

I o computer-readable program code means for piggy-backing a first portion of security 

I I information onto a second message sent from said server application to said client application, 

12 wherein said second message uses a second existing ore-existing message type and resp.qnd$ to 

13 said first message , 

1 Claim 59 (currently amended): The computer program product according to Claim 58, wherein 

(y 2 Raid first gristing pre-existing message type is a Hypertext Transfer Protocol (HTTP) GET 

3 request message and said second existing pre-existing message type is a response to said HTTP 

4 GET request message. 

1 Claim 60 (currently amended): The computer program product according to Claim 58, wherein 

2 said first uu&liug pre-existing message type is a Wireless Session Protocol (WSP) GET request 

3 message and said second exiting pre-existing message type is a response to said WSP GET 

4 request message. 

1 Claim 61 (original): The computer program product according to Claim 58, wherein: 

2 said first message requests a secure page from said server application, wherein said 

3 request further comprises an identifier of said secure page; and 

4 said second message sends a response to said secure page request to said client 

5 application, wherein said response further comprises a content portion encrypted using a session 
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6 key generated by said server applicat ion 

1 Claim 62 (original): The computer program product according to Claim 61, wherein: 

2 said request to select a message encoding scheme farther comprises an identifier of said 

3 client application, a nonce of said client application, and optionally including a timestamp; and 

4 said first portion further comprises a set of information encrypted using a public key of 

5 said server application. 

< 

1 Claim 63 (original): The computer program product according to Claim 62, wherein said set of 

2 information further comprises: 

3 a nonce of said server application, encrypted using a public key of said client application; 

4 and 

5 a security certificate of said server application* 



1 Claim 64 (original): The computer program product according to Claim 62 or Claim 63„ wherein 

2 first message further comprises zero or more parameters required for said secure page request. 




1 Claim 65 (new): A method for securely establishing a connection between a client application and 

2 a server application, further comprising steps of: 

3 sending, from the client application to the server application, a first message that uses a 



first pre-existing message type, wherein the first message requests information from the server 
application and includes a parameter portion, the parameter portion containing zero or more 
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6 parameters that may be used by the server application in creating the requested information; and 

7 sending* from the server application to the client application, a second message, 

8 responsive to receiving the first message, wherein: 

9 the second message uses a second pre-existing message type; 

10 the second message contains the requested information, which has been created 

1 1 using zero or more of the zero or more parameters and which has been encrypted using a session 

12 key; 

13 the session key has been created using a server nonce; and 

14 the second message farther contains the server nonce, encrypted using a public key 

1 5 of the client application. 

1 Claim 66 (new): The method according to Claim 65, wherein a client nonce is also used when 

2 creating the session key, and wherein the client nonce is transmitted on the first message. 

1 Claim 67 (new): A method fat securely establishing a connection between a client application 

2 and a server application, farther comprising steps of: 

3 sending, from the client application to the server application, a first message that uses a 

4 first pre-existing message type, wherein the first message requests information from the server 

5 application and signals the server application to propose an encoding scheme to be used for 

6 securely establishing the connection; 

7 sending, from the server application to the client application, a second message in 

8 response to the first message, wherein the second message uses a second pre-existing message 
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type and requests the client application to re-send the information request from the first message, 
and wherein the second message also transmits a description of the encoding scheme proposed by 
the server application; 

sending, from the client application to the server application, a third message in response 
to the second message, wherein the third message uses the first pre-existing message type and re- 
sends the information request from the first message, along with zero or more parameters to be 
used by the server application in creating the requested information and first security information 
for use by the server application in securely establishing the connection, according to the 
described encoding scheme; and 

sending, from the server application to the client application, a fourth message in response 
to the third message, wherein the fourth message uses a third pre-existing message type and 
contains the requested information, which has been encrypted using a session key created using 
the first security information as an input, and wherein the fourth message further comprises 
second security information which was also used as an input when creating the session key, the 
second security information encrypted such that it can be decrypted only by the client application. 

Claim 68 (new): The method according to Claim 67, wherein the parameters are encrypted using 
a public key of the server, according to the described encoding scheme. 

Claim 69 (new): The method according to Claim 67, wherein the first security information 
comprises a client nonce and the second security information comprises a server nonce. 
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